# Newly created access\_token is invalid

**URL:** <https://discuss.dev.twitch.com/t/newly-created-access-token-is-invalid/16255>\
**Category:** API\
**Created:** [June 19, 2018, 12:38pm UTC](https://discuss.dev.twitch.com/t/newly-created-access-token-is-invalid/16255 "2018-06-19T12:38:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dorian-marchal](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dorian-marchal/32/4687_2.png) [@dorian-marchal](https://discuss.dev.twitch.com/u/dorian-marchal)\
**Post date:** [June 19, 2018, 12:38pm UTC](https://discuss.dev.twitch.com/t/newly-created-access-token-is-invalid/16255/1 "2018-06-19T12:38:50Z")

</div>

I created an access\_token with this endpoint:

```auto
POST https://api.twitch.tv/kraken/oauth2/token

```

With following data :

```auto
client_id: XXX
client_secret: XXX
grant_type: client_credentials
scope: channel_read channel_editor channel_commercial

```

This gives me:

```auto
{
    "access_token": "XXX",
    "refresh_token": "",
    "scope": [
        "channel_read",
        "channel_editor",
        "channel_commercial"
    ],
    "expires_in": 4742688
}

```

(By the way, why doesn’t this endpoint give me a refresh\_token?)

When I try to check the validity of this newly created access\_token, with the following endpoint:

```auto
GET https://api.twitch.tv/kraken?oauth_token=XXX&client_id=XXX

```

I get:

```auto
{
    "identified": true,
    "token": {
        "valid": false,
        "authorization": null
    },
    "_links": {
        "channel": "https://api.twitch.tv/kraken/channel",
        "teams": "https://api.twitch.tv/kraken/teams",
        "user": "https://api.twitch.tv/kraken/user",
        "streams": "https://api.twitch.tv/kraken/streams",
        "ingests": "https://api.twitch.tv/kraken/ingests"
    }
}

```

Any idea?

---

<div class="post-metadata">

**Author:** ![3ventic](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/3ventic/32/298_2.png) [@3ventic](https://discuss.dev.twitch.com/u/3ventic)\
**Post date:** [June 19, 2018, 2:17pm UTC](https://discuss.dev.twitch.com/t/newly-created-access-token-is-invalid/16255/2 "2018-06-19T14:17:40Z")

</div>

`client_credentials` grant type is not used for anything in kraken. You should also use `id.twitch.tv` in the token flow as described in the documentation, not the old `api.twitch.tv/kraken/oauth2`: [https://dev.twitch.tv/docs/authentication/](https://dev.twitch.tv/docs/authentication/)

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [July 19, 2018, 2:17pm UTC](https://discuss.dev.twitch.com/t/newly-created-access-token-is-invalid/16255/3 "2018-07-19T14:17:43Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.